Splunk Search

How do you timechart a time-constricted search?

ejeny
Explorer

Heya,

This might be something really simple, but I just can't get my head around how to do it.

I'm using Splunk to estimate the concurrent number of users, by seeing anyone who has logged in in the past 2 hours (which is when you'd need to log back in due to timeouts, etc.). I then need to timechart that across a month to see what was the maximum for each day.

My current search looks like:

source=blah earliest=-2h 
| stats dc(ID) AS Users

Help would be most appreciated!

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@ejeny,

Try this ,

source=blah earliest=-1mon@mon
|eval day=strftime(_time,"%d-%b")|timechart span=2h dc(ID) as Users by day useother=f
|untable _time,day,Users|eventstats max(Users) as max by day
|maketable _time,day,Users,max|rename "count: *" as *,"max: *" as *(Max)

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@ejeny,

Try this ,

source=blah earliest=-1mon@mon
|eval day=strftime(_time,"%d-%b")|timechart span=2h dc(ID) as Users by day useother=f
|untable _time,day,Users|eventstats max(Users) as max by day
|maketable _time,day,Users,max|rename "count: *" as *,"max: *" as *(Max)

View solution in original post

0 Karma

ejeny
Explorer

Thank you for the help! It does seem to be what I'm looking for, albeit the format is a bit broken for my purpose. I would ideally want to sort everything by host as well.

 source=blah 
| timechart span=2h dc(ID) as Users by host

The above gives me a good neat table for every 2h, but I'm a bit confused how you retrieve the maximum. Would it not be possible without the Day field? The end result in your code ends up with each day as it's own line on a graph, making it very unreadable.

Thank you!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@ejeny,
As per your question , you need "maximum for each day" and for that we need to have data split across day. If that's not the case , on what basis you need maximum ?

0 Karma

ejeny
Explorer

I do still need the maximum per day, however I need to have all data sorted per host as well, ultimately, rather than having each individual day show as a line on a graph.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@ejeny, alright, what about this

 source=blah 
 |timechart span=2h dc(ID) as Users by host useother=f
 |untable _time,host,Users
 |eval day=strftime(_time,"%d-%b")
 |eventstats max(Users) as max by day,host
 |maketable _time,host,Users,max|rename "count: *" as *,"max: *" as *(Max)  
0 Karma

ejeny
Explorer

That did the trick, thank you!

0 Karma